Securing Linux Distros Part 3
Before I begin, I wasn't planning on doing a part 3. But due to my own pains with this process I figured it would be a fun post as well as figuring out a proper solution, so what is this fabled part 3 about? Updates.
Updating Linux distros are pretty simple for the most part, when running apt-get update the Linux machine checks the connection to canonical then it does a comparison between the stated version and current version of the machine, then it does a pull and install over the system. Usually, the machine doesn't need to reboot but things can happen, most likely you will at the worst have to restart the service.
When your updates are failing to start chances are canonical is down. First good troubleshooting might be to check canonicals website at https://status.web.canonical.com/#/
Mainly when I do updates for my Ubuntu servers, I use these commands:
sudo apt-get update -y && sudo apt-get upgrade -y
This will do updates with the confirm flag and then when updates are done will run any upgrades with the confirm flag.
sudo apt --autoremove
Removes previously used packages, cleans the system by uninstalling older packages
sudo apt-get update --fix-missing
Usually you'll be prompted to run this command to fix any packages that are broken or missing
Now for any servers you cannot wait till the weekend or for you to forget to update and do it right away we can install an automatic update package.
sudo apt install unattended-upgrades apt-listchanges -y
Installs the orginal package
sudo dpkg-reconfigure -plow unattended-upgrades
Creates the original update package which can be found at /etc/apt/apt.conf.d/50unattended-upgrades
sudo crontab -e
You can edit the crontab and setup somemore automation with updates, an example is adding this line to the current crontab:
0 2 * * 0 sudo apt update && sudo unattended-upgrade
This will run at 2am everyday with the update commands
By editing the file, I'll use vim we can change certian aspects of the automated updates, you can read the README.md here to figure out more with setting up your own config: https://github.com/mvo5/unattended-upgrades/blob/master/README.md
Last things you will want to know about updates is how to fix them when they break or can't update properly. One of the first things any good systems administrator will tell you is to have a backup! When an update breaks things going back to a previous version will save you time and effort in trying to repair what an update did.
Another good option is to clear your update packages:
sudo rm -rf /var/lib/apt/lists/
sudo apt update
This will clean out and rebuild the update packages
df -h
Checks the system for space, sometimes updates won't run because you've ran out of space!
sudo apt --fix-broken install
Lastly fixes broken packages like stated above
Updates are important to maintain a secure environment, but many times changing versions can lead to consequences. When things happen it's always good to know a quick fix or backup to previous version.
